Remove a Worm That Creates Scheduled Download Tasks

This guide explains how to remove a worm that creates scheduled tasks to download more malware without leaving its downloader running again. A scheduled task is a persistence mechanism: even after the original executable is deleted, the task can fetch and launch another payload.

It is written for Windows 10 and Windows 11, including home PCs and small-business workstations. Work from an administrator account, keep a second clean device nearby, and back up personal files where possible. If the computer handles banking, payroll or a shared business drive, isolate it and involve a trusted IT professional.

Contain the infection before it spreads

Disconnect the computer from Ethernet and switch off Wi-Fi. If Defender is scanning, let it finish before shutting down. Change important passwords later, from a clean device, rather than while the worm may still capture credentials. In an office, remove the workstation from the server and switch before handling its files.

A home NBN setup may use a Telstra Smart Modem or an Optus-supplied router, with phones and laptops sharing the connection. Unplug the affected PC first, then update router firmware only through the manufacturer’s official site. Never use a router administration link sent in an email.

Disable the malicious scheduled tasks

Open Task Scheduler as an administrator and review every folder, including entries marked hidden. Check each task’s Actions tab for PowerShell, cmd.exe, curl, wscript, mshta, rundll32 or a script under a temporary folder. Suspicious tasks often use random names, short repeat intervals, encoded commands or a trigger that runs when a user signs in.

For a fuller view, run schtasks /query /fo LIST /v in an elevated Command Prompt and note each task’s path, action, trigger and last-run time. Disable suspicious tasks first. After the payloads and other launch points have been removed, delete a confirmed malicious task with schtasks /delete /tn "Folder\TaskName" /f; do not remove Microsoft, update, backup or vendor-maintenance tasks simply because they run overnight. Around Australian daylight-saving changes, a 02:00 task may be skipped or run unexpectedly, especially when computers in different states use different clock settings.

Locate other ways the worm restarts

A scheduled task is only one route back into Windows. Compare these common launch points with the paths and filenames reported by your scanner.

Location	Warning signs	Safe response
Scheduled tasks	Unknown executables, repeated alerts, frequent triggers	Record and disable; delete after cleanup
Startup folders	A program launches at every sign-in	Uninstall the owner and remove the shortcut
Run and RunOnce	A new process appears after login	Confirm the value, then delete it
Services	An unknown service starts with Windows	Inspect its binary; remove it only after confirming malware

Use Win+R to open shell:startup and shell:common startup, then inspect the Run and RunOnce keys under HKCU and HKLM\Software\Microsoft\Windows\CurrentVersion. Export a registry key before editing it. Review Task Manager’s Startup apps and installed services as well. Verify an unfamiliar entry’s publisher, location and digital signature before removing it.

Quarantine payloads and scan the device

Run a full Microsoft Defender scan, updating its definitions from a clean device if the isolated computer cannot get them. Review each detection and its file path, quarantine confirmed malware, and avoid allowing Defender to restore it later. For deeper checking, choose Microsoft Defender Offline scan under Scan options and let the computer restart; a live malicious process can otherwise hide from a standard scan.

After the reboot, run another full scan. Remove quarantined items only when you no longer need them for recovery, and clear temporary download folders. If pop-ups, redirects or bundled applications remain, they may be a separate nuisance infection; our adware cleanup guide explains how to identify those extras.

On a capped regional fixed-wireless plan or metered 5G hotspot, schedule the offline download outside peak hours or use a trusted unlimited connection. A delayed scan is better than restoring the infection.

Clean network shares and other computers

Reconnect the host only when it is clean. Remove mapped drives and stored credentials for affected shares, then follow our network-share cleanup guide to inspect other systems and shared folders. Do not reconnect a host that still has active alerts.

On every Windows PC that used the same server, check its tasks, startup items and services. Scan the NAS or file server if its software supports it, because a Windows worm may deposit payloads in shared folders without altering the NAS operating system. Rotate reused passwords from the clean device. For studios, clinics and warehouses in Melbourne, Sydney or Brisbane, review shared-folder permissions with staff at arvo, when devices reconnect after lunch and can spread the infection again.

Restore settings and verify the cleanup

Delete the disabled tasks after cleanup, and remove confirmed payloads or malicious startup entries. Review browser extensions, downloads and shortcuts, since a worm may add a fake update page or redirect. Check Windows Security’s Protection history and confirm that no detection returns during normal use and after a reboot.

Keep the machine off shared networks while verifying the cleanup. If unwanted programs or browser changes persist, our adware articles explain how to distinguish nuisance software from the core infection. Treat persistent alerts, unexplained traffic or new shared-drive entries as unresolved rather than assuming the first scan was sufficient.

Prevent the next scheduled-task infection

Patch Windows, Microsoft Office, browsers and router firmware promptly. Use multi-factor authentication for email and remote access, avoid local administrator rights by default, restrict SMB access and disable SMB1. Scan USB drives before opening them, and never run installers from unexpected email attachments.

For a small Australian business, isolate shared servers where possible, restrict access by device and account, and keep a contact who can remove a workstation without disrupting clinical, accounting or warehouse systems. Back up important data to a clean protected destination and test restoration. Centralised task auditing and alerts help owners notice a recurring task that employees might dismiss as routine maintenance.